03 — Attack Scenarios | 04 — Detection Coverage | 05 — Defense Playbook

03 — Attack Scenarios

CAPEC-126: Path Traversal Direct Attack

# Web app returns files from /files/ directory
GET /app/download?path=documents/secret.txt
# Safe - returns: /files/documents/secret.txt

# Attack with path traversal
GET /app/download?path=../../../etc/passwd
# Returns: /etc/passwd (unrestricted access)

Real Attack: Kubernetes

# Kubernetes pod logs accessible via API
GET /api/v1/namespaces/default/pods/my-pod/log?path=../../../secrets.json
# Attacker retrieves cluster secrets

04 — Detection Coverage

Detection Rules

Monitor for:
- Requests containing '..' or '%2E%2E'
- Absolute paths when relative expected
- File access outside allowed directory
- Symlink dereferencing

Log Analysis

/app/download?path=documents/file.txt ✓ (normal)
/app/download?path=../etc/passwd ✗ (detected)
/app/download?path=%2E%2E/etc/passwd ✗ (detected)
/app/download?path=....//etc/passwd ✗ (detected)

05 — Defense Playbook

1. Whitelist Approach (Recommended)

Define allowed files:
- documents/report.pdf ✓
- documents/invoice.docx ✓
- anything else ✗

2. Input Validation (Mandatory)

- Reject if contains: .., /, \, null bytes
- Reject if starts with: /
- Use Path.resolve() for canonicalization

3. Principle of Least Privilege

- Web server user: read-only on application files
- No exec permission on upload directory
- No access to /etc, /sys, system files

4. D3FEND Mitigations

• D3-AC: Access control (chroot, Docker, containers)
• D3-FS: File system segmentation (separate partitions)
• D3-SA: System auditing (log all file access)

Next: 06 Reasoning Walkthrough